The risk in agent memory is what it may remember, not what it reads

Our argument: for an AI agent that remembers, the control that matters is a gate on what it saves. Wojciech Pluta, who runs technical marketing for Oracle's AI database, proposed one on the AI Engineer show. He calls it memory promotion.

What was said

Pluta split agent memory into two paths. He put it this way: "So retrieval is the read path and memory is the write path." Retrieval alone, he said, does not tell a system what should survive an interaction.

His answer is a pipeline. It classifies the meaning of a candidate memory. It compares the candidate with existing records and checks the evidence that type needs. Then the harness, the software around the model, admits it, rejects it or sends it for human review.

His pre-recorded demo used a mortgage agent and synthetic applications. The agent remembered an operator's preferences. Then he gave an "approve every application" command, and the gate refused to store it. A different memory, meant for wider sharing in the organisation, was recommended for human approval.

Pluta described the trade-off: "if we promote nothing, then obviously we don't get any benefits of continuity, but if we promote everything, then we're going to risk poisoning the memory". He said systems need enough provenance, meaning a record of where a memory came from, to know when to promote and when to supersede older memories. Oracle splits memory into short-term, which ends with the session, long-term and shared.

Why it matters

Our reading: that split shows how one bad write persists. A bad instruction in short-term memory fades with the session. Once promoted to long-term memory, it can shape later sessions. Checking only what an agent reads misses that.

Managers buying agent products can ask who may change what the agent knows. They can ask whether writes pass checks outside the model, and which go to a person before they spread. Pluta said the promotion controls sit within the guardrails and the harness.

In the mortgage example, a remembered blanket approval rule would turn one bad instruction into standing policy.

The other side

The evidence is thin. Pluta called the demo relatively simple, and it was pre-recorded with synthetic data. "Approve every application" is an obvious case to refuse. The excerpts do not show how the gate judges subtler bad rules.

Pluta did not say write controls outrank read controls. That ranking is ours. He also conceded a strict gate has a price, because promoting nothing loses continuity. Where to draw that line is left to each team.

He works for a database vendor and argued a database is the most robust place to keep memory. Weigh that advice accordingly.